Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 11.0

blog.torproject.org

Post reply on HN
Print view View original

21–30 of 100 posts

Re: Tor Browser 11.0

#21

Post by olddb »

zamadatix wrote: post #10
wolverine876 wrote: post #9

I've wondered about the fact that (AFAIK) Tor routes only TCP: 1. Is that (still) correct? 2. Can't web pages include non-TCP traffic, and if so, is it routed via Tor? For example, doesn't some some streaming media use UDP? 3. QUIC doesn't use TCP (deliberately, I think). Won't that affect Tor's long-term viability if everyone eventually moves to QUIC?

1. For now 2. That kind of traffic mostly died out with plugins like Flash, streaming media today is usually encapsulated in small frequent chunks over the same https channels as the rest of the page are delivered as that's what's available in JS/native. WebRTC reintroduced some UDP stuff and can be used for streaming but is still mostly used for peer to peer calls. 3. https://gitweb.torproject.org/tor-browser-spec.g…

> streaming media today is usually encapsulated in small frequent chunks over the same https channels as the rest of the page are delivered as that's what's available in JS/native

$> --- HLS ---<3

Re: Tor Browser 11.0

#22

Post by Aachen »

georgyo wrote: post #19
helios_invictus wrote: post #8

Earlier quoted context omitted.

Yes, but like IPV4 to IPV6 transition it's work.

Unlike IPv4 IPv6, there isn't an authority name service to advertise both connectable addresses. This makes discovery for the end user an explicit action. If they cannot connect on V2, the method to discover v3 is almost definitely out of band and potentially in the prone to hijacking.

So it would be best if those services simply advertise their new address on the v2 domain right? Rather than sit still and lose their traffic when everyone's forced to, or when attacks really become feasible.

It's not even a hard upgrade, afaik it's literally just a change of what address users have to copy/bookmark and nothing else. I just don't get what the reason to not upgrade is.

Re: Tor Browser 11.0

#23

Post by agumonkey »

triter wrote: post #3

Great to see the project still going strong, we need this type of tools more than ever.

I don't know about the low level / security details. But the Tor team constantly pushed good upgrades for a long time. Seriously impressive. Works great and is slick on pc and mobile.

Re: Tor Browser 11.0

#24

Post by saurik »

Aachen wrote: post #22
georgyo wrote: post #19

Earlier quoted context omitted.

Unlike IPv4 IPv6, there isn't an authority name service to advertise both connectable addresses. This makes discovery for the end user an explicit action. If they cannot connect on V2, the method to discover v3 is almost definitely out of band and potentially in the prone to hijacking.

So it would be best if those services simply advertise their new address on the v2 domain right? Rather than sit still and lose their traffic when everyone's forced to, or when attacks really become feasible. It's not even a hard upgrade, afaik it's literally just a change of what address users have to copy/bookmark and nothing else. I just don't get what the reason to not upgrade is.

> afaik it's literally just a change of what address users have to copy/bookmark and nothing else

...and all of the links that everyone has embedded in content all over the ecosystem.

Re: Tor Browser 11.0

#25

Post by scandinavian »

wolverine876 wrote: post #16
zamadatix wrote: post #10

Earlier quoted context omitted.

1. For now 2. That kind of traffic mostly died out with plugins like Flash, streaming media today is usually encapsulated in small frequent chunks over the same https channels as the rest of the page are delivered as that's what's available in JS/native. WebRTC reintroduced some UDP stuff and can be used for streaming but is still mostly used for peer to peer calls. 3. https://gitweb.torproject.org/tor-browser-spec.g…

Thank you! 2. So there is some non-TCP traffic. What happens when you load that page in Tor Browser, for example? Does it leak back to your clear Internet connection? Is it simply dropped? This seems like a critical issue. 3. Thanks. Do you know when that was written? To save others clicking the link and finding the applicable section, I'll paste it below. Designing and building your own protocol for Internet transpo…

2. TOR browser is built without webrtc support. There is no other way afaik, as firefox doesn't have a socket API for extensions anymore.

Re: Tor Browser 11.0

#27

Post by spurgu »

triter wrote: post #3

Great to see the project still going strong, we need this type of tools more than ever.

Same. The world would feel quite dystopian without Tor, Signal and other similar software aiming to preserve your privacy. I rarely use Tor but I'm soooo happy it exists.

Just started wondering: If Tor disappeared off the face of the earth right now, what would be the replacement?

1. Would it be an existing alternative that would become dominant in the space?

2. Would an identical software/network be built?

3. Would something new (and better) be built to replace it (and how would that look like)?

Re: Tor Browser 11.0

#28

Post by dillondoyle »

zamadatix wrote: post #10
wolverine876 wrote: post #9

I've wondered about the fact that (AFAIK) Tor routes only TCP: 1. Is that (still) correct? 2. Can't web pages include non-TCP traffic, and if so, is it routed via Tor? For example, doesn't some some streaming media use UDP? 3. QUIC doesn't use TCP (deliberately, I think). Won't that affect Tor's long-term viability if everyone eventually moves to QUIC?

1. For now 2. That kind of traffic mostly died out with plugins like Flash, streaming media today is usually encapsulated in small frequent chunks over the same https channels as the rest of the page are delivered as that's what's available in JS/native. WebRTC reintroduced some UDP stuff and can be used for streaming but is still mostly used for peer to peer calls. 3. https://gitweb.torproject.org/tor-browser-spec.g…

It's easy to get a webrtc fingerprint just using a public stun server, maybe people smarter can deploy their own. I've used it in our ad tracking js.

I'm not sure if Tor Browser turns off by default, searching found this one ticket which suggest that default flag but maybe it's not implemented out of the box.

[1] https://privacycheck.sec.lrz.de/active/fp_wrtc/fp_webrtc.htm...

[2] https://gitlab.torproject.org/legacy/trac/-/issues/8178

Re: Tor Browser 11.0

#29

Post by yjftsjthsd-h »

georgyo wrote: post #19
helios_invictus wrote: post #8

Earlier quoted context omitted.

Yes, but like IPV4 to IPV6 transition it's work.

Unlike IPv4 IPv6, there isn't an authority name service to advertise both connectable addresses. This makes discovery for the end user an explicit action. If they cannot connect on V2, the method to discover v3 is almost definitely out of band and potentially in the prone to hijacking.

I thought there was some meta tag you could stick in your page's HTML that said what its onion address was; couldn't you just add that with the v3 onion address and clients connecting over v2 would see it and switch over just as if they'd started from non-TOR?

Re: Tor Browser 11.0

#30

Post by yjftsjthsd-h »

Shadonototra wrote: post #26

Tor lost all credibility for sticking to firefox, not to mention all the other security issues discovered over the past few years

TOR is a privacy tool first; rebasing to a browser that aggressively undermines privacy at every turn would be a questionable use of resources.
Post reply on HN